{"id":182538,"date":"2026-07-08T10:54:06","date_gmt":"2026-07-08T08:54:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-x-org-server-21-1-24-xwayland-24-1-13-i-libxfont2-2-0-8-s-ustraneniem-uyazvimostej"},"modified":"2026-07-08T10:54:06","modified_gmt":"2026-07-08T08:54:06","slug":"obnovlenie-x-org-server-21-1-24-xwayland-24-1-13-i-libxfont2-2-0-8-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-x-org-server-21-1-24-xwayland-24-1-13-i-libxfont2-2-0-8-s-ustraneniem-uyazvimostej","title":{"rendered":"Update X.Org Server 21.1.24, xwayland 24.1.13, and libXfont2 2.0.8 addressing vulnerabilities","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Corrective releases of X.Org Server 21.1.24 and the DDX component (Device-Dependent X) xwayland 24.1.13 have been published. These updates enable the launch of X.Org Server for running X11 applications in Wayland-based environments. The new versions address two vulnerabilities that could potentially be exploited for privilege escalation in systems where the X server runs with root rights, as well as for remote code execution in configurations where session redirection via SSH is used for access. <\/p>\n
Fixed vulnerabilities: <\/p>\n
\n
CVE-2026-55999 \u2014 Buffer overflow in the implementation of 2D acceleration architecture Glamor, affecting the glamor_font_get() function, which builds the font texture atlas by rendering each glyph into a shared buffer. The issue arises because the size of the buffer was determined based on parameters specified in the font, while the copied data used the individual metrics of each glyph. To exploit the vulnerability, an attacker can prepare a specially crafted PCF file that specifies incorrect glyph metrics that exceed the allocated memory size. The overflow occurs on systems using the glamor backend (Xorg with the modesetting driver and Xwayland) when rendering text with the problematic font.\n
CVE-2026-56000 \u2014 Use-after-free in the CommonMakeCurrent() function when processing GLX contextTags. The issue is caused by the fact that when using the realloc() function, the data of the array cl->contextTags was moved to a new buffer, but a pointer referencing the old buffer remained in use. To initiate the buffer move, the client could occupy all allocated elements of the array for the GLX context and then create an additional context. <\/ul>\n